vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(restic): vm-esh-nas off env-file too; infra-ops now provisioned there

Browse Source 
Prime bootstrapped infra-ops on vm-esh-nas with playbooks/bootstrap-infra-ops-user.yaml.
It got the fleet-pinned uid/gid 850, NOPASSWD sudo with log_output, the docker
group and a 0700 home. That let playbooks/restic-repository-file.yaml migrate
the last restic host: the live profile matched the repo's pre-change sha,
its units no longer carry the URL, its secrets are vaulted, and the live and repo
profiles now match (a5ea75ea). All eight restic hosts are clean.

The staged helper script is gone, both from Prime's home on the host and from the
repo. The docs that described vm-esh-nas as lkraven-only are updated.
This commit is contained in:
vh
2026-09-27 01:56:04 -07:00
parent d775a01856
commit 30f2c977b7
6 changed files with 12 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/vm-esh-nas/README.md
+3 -1
View File
@@ -9,7 +9,9 @@ Dozzle agent, and Dockge.
- **LAN IP:** 10.0.50.154
- **FQDN:** `vm-esh-nas.esteban.net`
- **SSH:** `lkraven@vm-esh-nas` (key auth; `/etc/hosts` entry on the workstation)
- **SSH:** `infra-ops@10.0.50.154`: the fleet ops identity, uid/gid 850, NOPASSWD sudo, docker group.
Bootstrapped by Prime on 2026-09-27. `lkraven@vm-esh-nas` (the `vm-esh-nas` alias) is the human
account, key auth, with password sudo only.
## Hardware (from latest snapshot)